Capcom has confirmed that a third party gained unauthorized access to its CAPCOM ID membership service, and the Capcom data breach now covers 11,774,247 records worldwide. The publisher says it detected the intrusion on October 19, 2026 and published its apology notice three days later, according to Nintendo Life’s report on the notice. IGN, TweakTown, Windows Central, Yahoo Tech and Video Games Chronicle ran the same story within hours.
The exposed data is limited but still useful to attackers: registered email addresses, account-creation timestamps, last-login timestamps, login counts and the IP address used during the last login. Capcom also reported that 196 CAPCOM ID accounts had their passwords changed without authorization, and it reset those passwords. Credit-card information was not among the affected data, and CAPCOM ID-linked games and services stayed online.
The incident lands in a rough month for account security in gaming. We recently reported on the Double Counter breach that exposed 28 million Discord accounts and Capcom’s count now sits beside it. This analysis walks through what Capcom confirmed, what remains unproven, and what 11.77 million exposed email addresses mean for players and for the company.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Capcom Disclosed: The Numbers in the Notice
Capcom’s notice breaks the incident into three buckets. The first and largest covers 11,774,247 records, each tied to a registered email address and a set of system-level identifiers. The second is a subset of 43 of those records, where Capcom says additional personal details were also exposed. The third is the 196 accounts where someone changed the login password without the owner’s involvement.
Those proportions matter. The 43 records with date of birth, gender, country or region and nickname equal roughly 1 in 274,000 of the affected set. The 196 tampered accounts equal roughly 1 in 60,000. For the vast majority of people in the dataset, the exposure is an email address plus login metadata, not a full personal profile.
Capcom also stated that it has not confirmed disclosure of the passwords users set themselves. That sentence carries a lot of weight, and it deserves a careful reading. It says the company has not confirmed the leak of original passwords. It does not say the leak is ruled out, and the investigation was still running when the notice went out.
Timeline: From the October 19 Detection to the Public Notice
Capcom reports that it discovered the unauthorized access on October 19, 2026, a Monday. Reports citing the notice say the company then blocked the access and began its investigation. The public disclosure followed on October 22, which EGW and BigGo Finance both date in their coverage of the announcement. That is a three-day gap between detection and disclosure, which is short by the standards of large consumer breaches.
The speed counts in Capcom’s favor on two fronts. Account holders get a warning window before attackers can run large phishing waves, and regulators generally look favorably on prompt notification. Capcom’s earlier history, covered below, shows how different the company’s posture looks this time.
One caveat applies to dates. The fact that Capcom detected the intrusion on October 19 does not tell us when the intruder first got in. Reports to date do not state how long the third party had access, and Capcom has not published that figure.
What Data Was Exposed in the CAPCOM ID Breach
The table below organizes the disclosed fields by how many records they touch. All figures come from Capcom’s notice as relayed by the outlets named above.
| Data category | Records affected | Detail |
|---|---|---|
| Registered email address | 11,774,247 | Worldwide total across all CAPCOM ID regions |
| Account-creation date and time | 11,774,247 | System-specific identifier |
| Last-login date and time | 11,774,247 | System-specific identifier |
| Total number of logins | 11,774,247 | System-specific identifier |
| Client IP address at last login | 11,774,247 | System-specific identifier |
| Date of birth, gender, country or region, nickname | 43 | Subset of the main record set |
| Unauthorized password change | 196 | Capcom reset these passwords |
| Credit-card information | Not included | Reported as outside the affected data |
The IP address field is the one security teams will watch most closely. A last-login IP gives an approximate location and, for some users, a home internet provider. Combined with an email address, it lets a patient attacker build targeted lures that feel specific to the victim.
What Was Not Exposed: Passwords and Payment Cards
Two negatives anchor Capcom’s messaging. Credit-card information was not part of the affected data, and the company has not confirmed that users’ self-set passwords were disclosed. Both statements matter, and both come with limits.
On payments, reports say card data was not involved. That fits a common design in which a publisher’s membership database sits apart from the payment processors that handle purchases. We cannot say from public information how Capcom separates those systems, so treat the card statement as Capcom’s claim until the final investigation report says more.
On passwords, the careful reading is the one the company chose itself: not confirmed. Any claim that CAPCOM ID passwords leaked in bulk goes beyond what has been reported. What has been confirmed is that someone changed 196 passwords, and that is a different kind of event.
The 196 Changed Passwords: The Detail That Matters Most
Reading an email address out of a database is one thing. Changing a password on a live account is another, because it means the intruder could act inside the system and not just view it. That distinction is why the 196-account figure draws more attention from security practitioners than its small size suggests.
Several scenarios could explain it. An attacker with write access to account records could have altered those accounts directly. Alternatively, an attacker could have used the password-reset flow, taking over the email-based recovery path for a chosen set of accounts. The public notice does not say which happened, and we will not guess at the mechanism as if it were fact.
The business reason to take over an account is usually resale or abuse. Game accounts with long purchase histories, rare items or linked platform IDs carry value on gray markets. A selective takeover of 196 accounts out of nearly 11.8 million looks like targeting, not spray-and-pray. Capcom reset those passwords, and any owner who finds a login suddenly failing should contact support through official channels only.
Records Versus Accounts: Why the Headline Number Needs a Caveat
Headlines say “more than 11.7 million accounts.” Capcom’s own count is 11,774,247 records. The available reports do not establish that every record equals a unique person or even a unique account. One player could hold several CAPCOM ID entries across regions, and some entries may be dormant or abandoned.
The difference changes how readers should size their personal risk. If you ever created a CAPCOM ID, assume your email address is in the set until Capcom says otherwise. Do not assume the true count of affected humans is exactly 11.77 million. Capcom may publish a de-duplicated figure in a later update, and we will flag it if it does.
How It Happened: What Reports Establish and What They Don’t
Capcom’s notice says a third party accessed its systems without authorization. It stops there. No public report attributes the intrusion to a named group, a specific vulnerability or a particular technique, and the company says it will implement preventive measures based on the causes it identifies, which implies the root cause was still under study.
Why this is not yet a credential-stuffing story
Credential stuffing means attackers replay usernames and passwords stolen from other sites. We saw that pattern in Square Enix’s FFXIV warning, where credential stuffing was the concern. Capcom’s notice does not use that framing. Eleven million email records plus internal metadata such as login counts point to access to the account store itself, not to a wave of guessed logins. That is our read of the disclosed fields, not a confirmed finding.
What the field list suggests
Login counts, creation timestamps and last-login IPs are the sort of fields an authentication backend maintains for every user. Seeing all of them across the full record set hints at a query against, or export from, the membership system. It does not suggest access to game servers, save data or payment systems. Capcom has not confirmed any of this, so readers should treat it as informed inference until the company publishes a root-cause summary.
Phishing Risk: Why Email Plus Login Metadata Is Valuable
Even without passwords, a confirmed list of 11.77 million active-looking gaming emails has real resale and abuse value. Scammers can send messages that cite Capcom, CAPCOM ID or a recent login, and the metadata makes the lure more convincing. IGN’s coverage led with Capcom’s phishing warning.
The specific guidance in Capcom’s notice is blunt. As IGN reported, the company told customers: “If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files.” Source: IGN.
Expect fake “your account is locked” emails, fake refund notices and fake security alerts that push victims to a lookalike CAPCOM ID login page. A user who types a password into that page hands over the very credential the original breach did not take. Players who use the same password across services face the worst downside, since one phished login can unlock several accounts.
Capcom’s Own Words: The Notice and the Apology
Capcom’s public statement is short and formal, and the wording tells us how the company wants to frame the event. The notice opens by thanking users for their continued use of the service, then states the core fact. In the words quoted by Nintendo Life, Capcom said: “We recently discovered that our systems were subject to unauthorized access by a third party, resulting in a portion of our customers’ personal information being compromised.”
The phrase “a portion of our customers” is worth pausing on. With 11.77 million records involved, the portion is large, and the wording leaves room for the unique-account question raised above. The apology line followed. Nintendo Life quotes Capcom saying: “We deeply apologize for the significant inconvenience and concern this has caused our customers and all those affected.”
On next steps, the company committed to ongoing work. Per the same Nintendo Life report, Capcom said: “We will continue to conduct a thorough investigation, implement preventive measures based on the identified causes, and work to further strengthen our information security framework.” IGN adds a closing line from the notice: “Capcom takes this matter extremely seriously and will continue its detailed investigation.”
What the statement leaves out is as telling as what it includes. It names no cause, no timeline for the root-cause report, and no count of unique people. It also offers no mention of offered services such as credit monitoring or mandatory multi-factor authentication. Those gaps are normal in a first notice, and they define what to watch for in a follow-up.
Capcom’s Security History: From the 2020 Ransomware Attack to CAPCOM ID
This is not Capcom’s first major incident. In November 2020, the company disclosed a ransomware attack that reporting at the time attributed to the Ragnar Locker group. Later accounts put the number of potentially affected people at roughly 350,000. That event involved encrypted internal systems and stolen files, a very different profile from the 2026 account-database exposure.
Scale is the clearest contrast. The 2026 record count of 11,774,247 is about 34 times the 2020 figure of roughly 350,000 people. The nature of the data is lighter this time, with no reported card data and only 43 records carrying richer personal details, but the reach is far wider. The table below lines up Capcom’s two incidents beside other breaches we have covered.
| Incident | Year | Scale reported | Note |
|---|---|---|---|
| Capcom CAPCOM ID | 2026 | 11,774,247 records | Emails, login metadata, IPs |
| Capcom ransomware (Ragnar Locker) | 2020 | About 350,000 people potentially affected | Ransomware, not an account-database event |
| Double Counter / Discord | 2026 | 28 million accounts | Covered in our Discord report |
| California ETS | 2026 | 7 million students (reports cite) | Figure comes from reports |
| Pentagon DMDC | 2026 | 3 million+ people | Class action filed |
Ransomware crews remain active against gaming and other sectors, as the FBI and CISA warning on SafePay’s 600 victims showed. The CAPCOM ID event shows the other half of the threat picture. Not every serious incident involves a ransom note, and a quiet database pull can hit more people than an encryption attack.
Market and Industry Impact: Gaming Accounts as Prime Targets
Publisher-wide account systems like CAPCOM ID have become attractive because one database ties together many games. EGW describes CAPCOM ID as the account layer behind online play in Street Fighter 6 and Monster Hunter. A single weak point there reaches players across franchises, which raises the payoff for an attacker.
Capcom’s games stayed available, so there is no sign of an operational outage. The harm is reputational and legal, not a lost-launch-week scenario. Players will judge Capcom on how fast it explains the cause and whether it tightens login security, for instance by pushing stronger sign-in options. The gap is visible elsewhere in the industry too: we noted that Steam still lacks passkeys while FIDO counts 7 billion users, which shows how uneven account protection is across big platforms.
For investors, the direct financial exposure looks modest on current facts. No card data, no service outage, and a small count of tampered accounts limit the immediate cost. The larger variables are notification costs, possible regulatory attention and any litigation. We track these themes across our cybersecurity coverage, and Capcom now joins the list of publishers that must show a credible fix.
Regulatory and Legal Exposure
Capcom is a Japanese company with a global player base, so several privacy regimes may apply. Japan’s Act on the Protection of Personal Information sets breach-reporting and notification duties. If European residents are among the affected records, the GDPR can require notice to a supervisory authority within 72 hours of the company becoming aware of a qualifying breach. The available reports do not say which filings Capcom has made, so we cannot confirm compliance either way.
Class actions are the other front. Breach lawsuits often follow large disclosures, especially in the United States, even when exposed data is limited to emails and metadata. Our report on the Pentagon DMDC class action over a 3 million-plus breach shows how quickly plaintiffs move once a count is public. Whether a Capcom suit materializes is unknown, and no filing has been reported.
What CAPCOM ID Users Should Do Now
Capcom has already reset the 196 tampered accounts, but every CAPCOM ID holder should act as though their email is in the dataset. The steps below take about 15 minutes and cost nothing.
- Change your CAPCOM ID password to a unique one, and change any other account that shares it.
- Turn on multi-factor authentication wherever a service offers it, and prefer app-based or hardware methods over SMS.
- Review recent account activity and sign out of sessions you do not recognize.
- Treat any email about the breach, refunds or account verification as suspect. Go to the official site by typing the address yourself.
- Watch for login failures. A password you did not change that suddenly stops working is a red flag.
- Contact Capcom through official support if profile details look altered.
Upgrade to phishing-resistant sign-in
Phishing is the main follow-on risk, so a security key beats any password policy. Our walkthrough on setting up a YubiKey for phishing-resistant login covers the process in 13 steps. A hardware key refuses to authenticate on a lookalike site, which neutralizes the exact lure a leaked email list enables.
Predictions: What Happens Next
These are our own forecasts based on the disclosed facts, not reported events or statements from Capcom.
- Capcom publishes a follow-up with a root cause. The company promised a thorough investigation, and pressure from users and regulators makes a second notice likely before the end of 2026.
- Phishing campaigns using the CAPCOM name surface within weeks. A confirmed list of 11.77 million emails is too valuable for scammers to ignore.
- The record count gets refined. A de-duplicated figure for unique people will probably land below 11.77 million, though by how much is unknown.
- Capcom strengthens CAPCOM ID sign-in. Expect stronger multi-factor options or login-alert features as part of the preventive measures it promised.
- At least one legal or regulatory action appears. Large breach counts attract complaints, and a privacy regulator inquiry or a civil suit is plausible even with limited data.
Frequently Asked Questions
How many CAPCOM ID accounts were affected?
Capcom reports 11,774,247 records worldwide. Reports do not establish that each record is a unique account, so the number of affected people could be lower.
What information was exposed in the Capcom data breach?
The records include the registered email address, account-creation date and time, last-login date and time, total login count and the client IP address from the last login. In 43 records, date of birth, gender, country or region and nickname were also affected.
Were passwords leaked?
Capcom has not confirmed disclosure of users’ self-set passwords. It did confirm that passwords on 196 accounts were changed without authorization, and it reset them.
Was my credit card exposed?
Reports say credit-card information was not included in the affected data. Check your statements as a routine precaution anyway.
Can I still play my Capcom games?
Yes. CAPCOM ID-linked games and services remained available after the disclosure.
When did Capcom discover the breach?
Capcom says it detected the unauthorized access on October 19, 2026. It published its public notice on October 22, according to reports.
Is this the same as the 2020 Capcom hack?
No. The 2020 incident was a ransomware attack attributed to Ragnar Locker, with roughly 350,000 people potentially affected in later reporting. The 2026 event involves unauthorized access to the CAPCOM ID membership service and a much larger record count.
What should I do if I get a suspicious Capcom email?
Do not click links or open attachments. Capcom’s own notice tells customers to exercise caution with suspicious messages. Visit the official site by typing the address directly.
